finance-phantom[.]net

The domain finance-phantom.net was registered on November 13, 2025 through MainReg INC. and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 185.107.44.123, which is hosted in the Netherlands and belongs to AS43350 NForce Entertainment B.V. The name servers listed are athena.ns.cloudflare.com and rocco.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No SSL certificate is present, meaning the site does not offer HTTPS encryption.

The page title returned from the last known snapshot is "Finance Phantom | Official Website Platform," and the domain is explicitly marked as impersonating the brand Phantom with a declared crypto‑scam purpose. Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1 / 100, Gridinsoft a score of 0 / 100, and the domain appears on a single security blocklist, PhishDestroy. VirusTotal analysis shows five out of ninety‑five scanning engines flag the domain, reinforcing the malicious assessment.

The combination of a low‑reputation registrar, Cloudflare DNS, a Netherlands‑based IP, absence of TLS, and the presence of brand‑impersonation indicators collectively point to a deliberate attempt to deceive users seeking Phantom‑related financial services. Defenders should block the domain and its associated IP at perimeter and endpoint controls, monitor for any resurgence of the host, and add the domain to internal threat intel feeds. Continuous re‑scanning of the IP and periodic WHOIS checks are recommended to detect any re‑registration or changes in hosting that could revive the malicious infrastructure.